AWS aws-backup high security documentation change

Service: aws-backup · 2026-02-25 · Security-related high

File: aws-backup/latest/devguide/security-iam-awsmanpol.md

Summary

Added malware scan permissions (guardduty:StartMalwareScan, guardduty:GetMalwareScan, iam:PassRole) to AWSBackupServiceRolePolicyForBackup

Security assessment

Explicitly adds malware scanning capabilities to backup service role policy, directly addressing security monitoring of recovery points

Diff

diff --git a/aws-backup/latest/devguide/security-iam-awsmanpol.md b/aws-backup/latest/devguide/security-iam-awsmanpol.md
index cec902e2f..b5a246232 100644
--- a//aws-backup/latest/devguide/security-iam-awsmanpol.md
+++ b//aws-backup/latest/devguide/security-iam-awsmanpol.md
@@ -730,0 +731,7 @@ Change | Description | Date
+AWSBackupServiceRolePolicyForBackup – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `guardduty:StartMalwareScan`
+  * `guardduty:GetMalwareScan`
+  * `iam:PassRole`
+
+These permissions allow AWS Backup to initiate malware scans on your recovery points. | February 23, 2026